Apple recommends that users with older iOS versions update their iPhones to defend against web-based attacks using exploit kits like Coruna and DarkSword.

These attacks leverage harmful web content to target outdated iOS versions, initiating a chain of infections that can lead to the theft of private information.

“For example, if you have an older version of iOS and click on a dangerous link or visit a compromised site, your iPhone’s data could be stolen,” Apple stated in a support document.

“We thoroughly examined these issues once discovered and promptly released software updates for the latest operating systems to fix vulnerabilities and stop these attacks.”

Users with the latest iPhone software do not need to do anything. This includes iOS versions 15 through 26, which include fixes for security flaws used by these exploit kits. For others, Apple suggests the following:

• Update to iOS 15.8.7, iPadOS 15.8.7, iOS 16.7.15, and iPadOS 16.7.15 for older devices that cannot update to the newest iOS.
• Update to iOS 15 for devices with iOS 13 or iOS 14 to get the latest security, as well as a Critical Security Update expected in the “next few days.”
• Consider enabling Lockdown Mode, if available, when updating your device isn’t possible, to reduce attack opportunities and safeguard against malicious web content and other threats.

“Keeping your software updated is the most important thing you can do to protect your Apple devices, and devices with updated software were not affected by these reported attacks,” Apple mentioned.

Apple’s warning comes after recent reports about two iOS exploits utilized by various attackers to steal private data from compromised devices. These kits are distributed through watering hole attacks on compromised websites.

iVerify stated that these discoveries show that iOS vulnerabilities, previously used for targeted mobile spyware attacks by state-sponsored actors, are now being widely exploited by other attackers.

“The exploit’s relative ease of deployment, along with its rapid adoption by various attackers in multiple countries, indicates that these powerful tools are now easily accessible on the secondary market for less sophisticated actors,” said Spencer Parker, chief product officer at iVerify, adding, “nation-state-level mobile exploitation is now available for mass attacks.”

“This represents a new level of scale, making widespread mobile attacks a significant and unavoidable concern for all companies. Evidence suggests these exploits can be easily modified and redeployed, making it highly probable that modified deployments are actively infecting unpatched users.”